CVE-2013-2191: Input Validation
python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
Other sources
python-bugzilla uses the default xmlrpclib transports, which are based on classes in httplib which do not perform server certificate checking. As a result, man-in-the-middle attacks on the HTTPS connection are possible.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2191?
CVE-2013-2191 is considered a high-severity vulnerability due to its potential to allow man-in-the-middle attacks.
How do I fix CVE-2013-2191?
To fix CVE-2013-2191, update python-bugzilla to version 0.9.0 or higher.
What software is affected by CVE-2013-2191?
CVE-2013-2191 affects all versions of python-bugzilla prior to 0.9.0.
What type of attack does CVE-2013-2191 enable?
CVE-2013-2191 enables man-in-the-middle attacks through the spoofing of Bugzilla servers.
Does CVE-2013-2191 affect specific operating systems?
Yes, CVE-2013-2191 affects various versions of Fedora and openSUSE that use impacted versions of python-bugzilla.